Timing Attack Complete - Downgrade from any Xbox 360 kernel WITHOUT CPU Key!

[Zeus]

Robinsond has managed to successfully boot an Xbox 360 with one flashed eFuse with kernel 1888 using the timing attack method that was talked about a while back. Although it is out of the reach of most, it is a great achievement and if the method gets optimized further it could be a gateway for homebrew on the Xbox 360. In order to do the timing attack as is, your Xbox 360 must have an old exploitable kernel in the form of either 4352 or 4548 but Live currently only accepts the latest 5766 kernel.



Done it! My bricked box - one blown eFuse but no CPU key and no valid flash dump that would boot (I did have a valid 2241 dump though that would no longer boot because of the eFuse) - is now alive and well and booting 2.0.1888 with a patched CB (LD count = 1) and a "guessed" hash. Even doing it "manually" only took 3 evenings ;) Now, sleep

Just to be clear, the timing attack will allow you to downgrade to 2.0.1888. You can then upgrade to 4532 & run the KK sploit and obtain your CPU keys. You should be able to replace the original CB after the upgrade (this needs to be confirmed) and then the only "clue" to what happened is that you may have 1 or 2 more burned eFuses for the HV/Kernel version you are running


News Source: <A href="http://www.xboxhacker.net/index.php?topic=8319.0" target="_blank">Xboxhacker.net</a>

[KainXS]

tHE TIME HAS COMING

first it was the psp downgrade/unbricker and now they can get cpu keys on the 360 with blown efuses

great news for one day

this is major though

theoretically since the cpu key is now usable you can change the dvd key and probably the machine ID/account as well which might allow for banned 360's to get on live

the big question is "Does microsoft have all the machine keys registered already or does the 360 itself send a register request on first boot to the Xbox Live KV server

[recall2000]

[QUOTE=Robinsond]Done it! My bricked box - one blown eFuse but no CPU key and no valid flash dump that would boot (I did have a valid 2241 dump though that would no longer boot because of the eFuse) - is now alive and well and booting 2.0.1888 with a patched CB (LD count = 1) and a "guessed" hash. Even doing it "manually" only took 3 evenings Now, sleep

Just to be clear, the timing attack will allow you to downgrade to 2.0.1888. You can then upgrade to 4532 & run the KK sploit and obtain your CPU keys. You should be able to replace the original CB after the upgrade (this needs to be confirmed) and then the only "clue" to what happened is that you may have 1 or 2 more burned eFuses for the HV/Kernel version you are running
[QUOTE]

WTF is all that about? ;) Ask me one on music :)

Sounds like it's some time away from a general user mod. Some damn fine work there. Got to admire the persistence.

[KainXS]

he had to stay up for 3 days to get it to finish, of course he's tired

[Sinar]

This allows a downgrade without a cpu key, you can then upgrade to an exploitable firmware to dump keys etc.
What is interesting is the method to perform the attack, the nand is rated for 100,000 read/write cycles and it only took 4096 'guesses'.
In theory the attack could of fully killed off the nand if the procedure was not correct. This is a long way from home modding.

[Zak]

This allows a downgrade without a cpu key, you can then upgrade to an exploitable firmware to dump keys etc.
What is interesting is the method to perform the attack, the nand is rated for 100,000 read/write cycles and it only took 4096 'guesses'.
In theory the attack could of fully killed off the nand if the procedure was not correct. This is a long way from home modding.
I wouldn't be so sure about that. Right now its a complicated process but since it is open source ANYONE can pick up on it and improve it. In theory mosts steps could even be automated or incorporated into a modchip installation procedure.

We already know its possible to dual boot so its only a matter of time now until this goes mainstream.

[DaFireStarter]

These people are pure geniuses!

[lc204]

So when is XBMC coming to the 360?

[poisonousjuice]

why is this hacking news on MC? I want more articles of asian girls pretending to play PSPs and kids putting power cords in water.

[poulpyx]

So when is XBMC coming to the 360?
There's no real immediate need for a dedicated media center.
The real good thing would be dedicated drivers for linux :D There's already a media center and a lot of emulators that just needs to take full advantage of the power of the 360.

You can check out this page for more infos : http://www.free60.org/wiki/Linux_Kernel

Anyway, congratulations on the downgrading, it will definatly kick up the linux drivers ^__^'

[MadonnaProject]

well done. homebrew please.